Shibboleth: Re-test Institution-wide Shibboleth groups and CRUD API operations

[kcondon]

This is a placeholder to test the shib groups API.

[kcondon]

Passing to Phil to provide institutional shib groups for Harvard and MIT in setup-optional-harvard script

[pdurbin]

Note to self: https://dataverse-demo.iq.harvard.edu/Shibboleth.sso/DiscoFeed has "entityID": "https://idp-staging.mit.edu/shibboleth" but I'll need to figure out the real entityId for MIT rather than the staging server we used for interop testing.

[pdurbin]

Passing to Phil to provide institutional shib groups for Harvard and MIT in setup-optional-harvard script

Done. I also removed the creation of the TestShib sample group from setup-all. I left the JSON file in place so it can still be created, if needed.

[pdurbin]

@kcondon for testing with the MIT staging server, please replace...

"pattern": "urn:mace:incommon:mit.edu"

with

"pattern": "https://idp-staging.mit.edu/shibboleth"

... in the JSON file I provided here before running the curl command: https://github.com/IQSS/dataverse/blob/ab0c79d6462dbb979de8786674a691f6378aa0e9/scripts/api/data/shibGroupMit.json

The file should look like this:

{
  "name": "All MIT Shibboleth Users",
  "attribute": "Shib-Identity-Provider",
  "pattern": "https://idp-staging.mit.edu/shibboleth"
}

[pdurbin]

@kcondon I'm preparing a list of open issues having to do with Shibboleth for an upcoming meeting. This issue is still open and I'm not sure why.

On a related note, @bencomp recently asked at http://irclog.iq.harvard.edu/dataverse/2015-12-07#i_28069 if the JSON for Shib groups could be changed, saying "the API should accept a group definition that has multiple attribute-pattern combinations in a list" but perhaps this is "arbitrary attributes and regex support" territory (#1515, no work done on this yet) rather than the existing "institution-wide" groups we developed in #1401. I assume this issue is/was about testing the institution-wide Shib groups.

[pdurbin]

As of http://guides.dataverse.org/en/4.2.4/api/native-api.html the following are not documented:

• List: curl http://localhost:8080/api/admin/groups/shib
• Create: curl http://localhost:8080/api/admin/groups/shib -X POST -H 'Content-type:application/json' --upload-file shibGroupTestShib.json
• Delete: curl -X DELETE http://localhost:8080/api/admin/groups/shib/1

[pdurbin]

This this ticket never really went through QA and @kcondon opened it originally as "API: Test Shib groups API" I'm reopening it to test the CRUD operations that have been available since 4.0 but not documented until just now in 21bd0e8 which can be previewed at http://guides.dataverse.org/en/2939-shib/installation/shibboleth.html#institution-wide-shibboleth-groups

Also, you can now see which groups you are a part of when you log in in server.log (which I added as part of the "debug Shibboleth issue at #2916). It looks like this:

Groups for user 11 (@myself): [Authenticated Users (:authenticated-users), All Users (:AllUsers), All testshib.org Shibboleth Users (&shib/2)]]]

[bencomp]

@pdurbin did you say you reopened this issue? It looks closed to me…

[pdurbin]

@bencomp whoops, I meant to. Thanks for catching that.

Moving to QA. http://guides.dataverse.org/en/2939-shib/installation/shibboleth.html#institution-wide-shibboleth-groups explains the CRUD operations for Shibboleth groups. Also, you can now see which groups you are a part of when you log in in server.log (which I added as part of the "debug Shibboleth issue at #2916). It looks like this:

Groups for user 11 (@myself): [Authenticated Users (:authenticated-users), All Users (:AllUsers), All testshib.org Shibboleth Users (&shib/2)]]]

[kcondon]

Retested and they work. Found an indexing issue and reported as a separate ticket. Had existed in v4.3. #3039